1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# 生成相关证书
certs                      Certificate generation
  /ca                        Generate the self-signed Kubernetes CA to provision identities for other Kubernetes components
  /apiserver                 Generate the certificate for serving the Kubernetes API
  /apiserver-kubelet-client  Generate the certificate for the API server to connect to kubelet
  /front-proxy-ca            Generate the self-signed CA to provision identities for front proxy
  /front-proxy-client        Generate the certificate for the front proxy client
  /etcd-ca                   Generate the self-signed CA to provision identities for etcd
  /etcd-server               Generate the certificate for serving etcd
  /etcd-peer                 Generate the certificate for etcd nodes to communicate with each other
  /etcd-healthcheck-client   Generate the certificate for liveness probes to healthcheck etcd
  /apiserver-etcd-client     Generate the certificate the apiserver uses to access etcd
  /sa                        Generate a private key for signing service account tokens along with its public key

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

​```shell
#生成集群配置yaml
kubeadm config view > /root/cluster.yaml
# 将ETCD的证书文件软连接到 /etc/kubernetes/pki 目录下
rm -rf /etc/kubernetes/pki/etcd
ln -sf /etc/etcd /etc/kubernetes/pki/etcd
ln -sf /etc/etcd/apiserver-etcd-client.crt /etc/kubernetes/pki/apiserver-etcd-client.crt
ln -sf /etc/etcd/apiserver-etcd-client.key /etc/kubernetes/pki/apiserver-etcd-client.key

# 更新集群证书(这个命令会同时更新kubeconfig)
kubeadm alpha certs renew all

# 更新kubeconfig
kubeadm init phase kubeconfig kubelet

1
2

# 表示只编译kubeadm模块
KUBE_BASE_IMAGE_REGISTRY="registry.lqingcloud.cn/k8s.gcr.io/build-image" build/run.sh make kubeadm KUBE_BUILD_PLATFORMS=linux/amd64 

1
2
3
4
5
6
7
8

authentication:
  anonymous: 
    enabled: false   # 禁止匿名访问
  webhook:           # WebHook认证
    cacheTTL: 2m0s
    enabled: true
  x509:				# x509 认证
    clientCAFile: /etc/kubernetes/pki/ca.crt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

apiVersion: v1
kind: Secret
metadata:
  # Name MUST be of form "bootstrap-token-<token id>"
  name: bootstrap-token-07401b
  namespace: kube-system # 1.18文档中说明，只能在kube-system中创建

# Type MUST be 'bootstrap.kubernetes.io/token'
type: bootstrap.kubernetes.io/token
stringData:
  # Human readable description. Optional.
  description: "The default bootstrap token generated by 'kubeadm init'."

  # Token ID and secret. Required.
  token-id: 07401b
  token-secret: f395accd246ae52d

  # Expiration. Optional.
  expiration: 2017-03-10T03:22:11Z

  # Allowed usages.
  usage-bootstrap-authentication: "true"
  usage-bootstrap-signing: "true"

  # Extra groups to authenticate the token as. Must start with "system:bootstrappers:"
  auth-extra-groups: system:bootstrappers:worker,system:bootstrappers:ingress

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7183422665212995921 (0x63b0a4dac782a951)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=kubernetes
        Validity
            Not Before: Jun 30 10:21:40 2020 GMT
            Not After : Oct 23 09:13:44 2021 GMT
        Subject: CN=kube-apiserver
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    略
                    cd:3f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
            X509v3 Subject Alternative Name: 
                DNS:172.24.135.44, DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc, DNS:kubernetes.default.svc.cluster.local, IP Address:10.188.0.1, IP Address:172.24.135.44, IP Address:172.24.135.245
    Signature Algorithm: sha256WithRSAEncryption
         略

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: sdp-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
  namespace: kube-system
subjects:
- kind: User
  name: sdp-reader
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: sdp-reader
  apiGroup: rbac.authorization.k8s.io

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

cat << EOF | cfssl genkey - | cfssljson -bare server
{
  "CN": "sdp-reader", # 用户名信息
  "hosts": [],        # 服务端用户名信息，作为客户端证书时可以不填
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Fujian",
      "L": "Fuzhou",
      "O": "ND",        # O:OU 被K8S当作用户的Group信息
      "OU": "SDP"
    }
  ]
}
EOF

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

cat << EOF > CSR.yml
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: sdp-reader-csr
spec:
  request: $(cat server.csr | base64 | tr -d '\n')
  usages:
  - client auth
EOF

kubectl get csr sdp-reader-csr -o jsonpath='{.status.certificate}' | base64 --decode > server.crt

1
2
3
4

kubectl certificate approve sdp-reader-csr
kubectl config set-credentials sdp-reader --client-key=/root/lq/tmp/server-key.pem --client-certificate=/root/lq/tmp/server.crt --embed-certs=true
kubectl config set-context sdp-reader --cluster=kubernetes --user=sdp-reader
kubectl config use-context sdp-reader